Magnus Hagander's PostgreSQL blog (Entries tagged as release)http://blog.hagander.net/
enSerendipity 1.6.2 - http://www.s9y.org/The end of PostgreSQL 8.4 - a small tributehttp://blog.hagander.net/archives/221-The-end-of-PostgreSQL-8.4-a-small-tribute.html
PostgreSQLhttp://blog.hagander.net/archives/221-The-end-of-PostgreSQL-8.4-a-small-tribute.html#commentshttp://blog.hagander.net/wfwcomment.php?cid=2215http://blog.hagander.net/rss.php?version=2.0&type=comments&cid=221nospam@example.com (Magnus Hagander)
<p><a onclick="_gaq.push(['_trackPageview', '/extlink/www.postgresql.org/about/news/1534/']);" href="http://www.postgresql.org/about/news/1534/" onclick="window.open(this.href, '_blank'); return false;">Todays release</a> marks the end of life for PostgreSQL 8.4, after 5 years of service.</p>
<p>I've found it interesting that PostgreSQL 8.4 was probably the first release to actually make it possible to run fairly busy PostgreSQL installations without any hands-on at all. There were many important parts to 8.4 that made that happen, such as much better standby database support (though not hot standby yet - that came in 9.0) and better statistics and monitoring systems. 8.4 also came with Recursive CTEs (WITH-queries) and Window Aggregates, both of which made a whole new set of applications possible.</p>
<p>But I think nothing actually brought about this "run without hands-on" as much as the new code for Visibility Map (VM) and in particular the automatic sizing of the Free Space Map (FSM). Anybody who deployed 8.3 or earlier in any kind of busy environment knows the pain of trying to configure <i>max_fsm_pages</i> correctly. It was almost impossible to get it right, and the value of right kept changing with your load and data. And the worst part of it all was that if you got it wrong you were in trouble - there wasn't really any remedy other than taking your database offline (or at least read-only) for manual full database vacuums (there were tricks to get around the vacuum specifics, but the core problem was there). So what happened was that a lot of those people who knew what to do just increased that number to something that was "big enough", which usually meant "way too big" and thus wasting resources. And even with that, sometimes ran into it not being big enough because the workload changed.</p>
<p>In fact, I think more or less every single system I did reviews for customers for on those versions had a substantially wrong number in <i>max_fsm_pages</i> - usually the default value because they had no idea what to do with it - and were paying the price for it.</p>
<p>Extra funny is that I've been talking to Heikki (who wrote the dynamic FSM and VM code) a few times recently, and he's still surprised that these changes had such a big impact on real life deployments. Probably because it's one of those things that is usually not a big problem at all in small installations, developer installations, and testing systems, but can quickly snowball in real life production. I think many of us didn't realize before the release actually made it out there how useful it would be.</p>
<p>This feature, together with things like Recursive CTEs and Window Functions really makes 8.4 one of the landmark PostgreSQL releases. It's easier to point to releases like 9.0 which had Streaming Replication and Hot Standby because they are sexier and more marketable features, but infrastructure like this is more important than we often think.</p>
<p>8.4 got rid of some of the hardest things to tune. Let's stay on the path of trying to keep the system simple enough to use that it doesn't need handholding, and look forward to the upcoming <a onclick="_gaq.push(['_trackPageview', '/extlink/www.postgresql.org/about/news/1533/']);" href="http://www.postgresql.org/about/news/1533/" onclick="window.open(this.href, '_blank'); return false;">9.4 release</a>!</p>
Thu, 24 Jul 2014 11:32:00 +0000http://blog.hagander.net/archives/221-guid.html8.4ctefsmpostgresqlreleasewindow aggregatesPostgreSQL and the OpenSSL Heartbleed vulnerabilityhttp://blog.hagander.net/archives/219-PostgreSQL-and-the-OpenSSL-Heartbleed-vulnerability.html
PostgreSQLhttp://blog.hagander.net/archives/219-PostgreSQL-and-the-OpenSSL-Heartbleed-vulnerability.html#commentshttp://blog.hagander.net/wfwcomment.php?cid=2197http://blog.hagander.net/rss.php?version=2.0&type=comments&cid=219nospam@example.com (Magnus Hagander)
<p>Is your PostgreSQL installation vulnerable to the <a onclick="_gaq.push(['_trackPageview', '/extlink/heartbleed.com']);" href="http://heartbleed.com" onclick="window.open(this.href, '_blank'); return false;">Heartbleed</a> bug in OpenSSL? The TL;DR; version is "maybe, it depends, you should read this whole thing to find out". If you <i>are</i> vulnerable, it is a high risk vulnerability!</p>
<p>The slightly longer version is that it will be vulnerable if you are using SSL, and not vulnerable if you are not. But the situation is not quite that easy, as you may be using SSL even without planning to. PostgreSQL also not provide any extra protection against the bug - if you are using SSL, you are vulnerable to the bug just as with any other service.</p>
<p>As the bug is in OpenSSL, however, what you need to get patched is your OpenSSL installation and not PostgreSQL itself. And of course, <i>remember to restart your services</i> (this includes both PostgreSQL and any other services using SSL on your system). You will then have to consider in your scenario if you have to replace your SSL keys or not - the same rules apply as to any other service.</p>
<h3 id="toc0">It depends on if SSL is enabled</h3>
<p>PostgreSQL by default ships with SSL turned off on most platforms. The most notable exception is Debian and derivatives (such as Ubuntu), which enable SSL by default.</p>
<p>If SSL is disabled globally, <b>your installation is not vulnerable</b>.</p>
<p>The easiest way to check this is to just use a simple SQL query:</p>
<pre><code><div class="geshi" style="text-align: left"><br />postgres=<span style="color: #808080; font-style: italic;"># show ssl;</span><br />&#160;ssl <br /><span style="color: #808080; font-style: italic;">-----</span><br />&#160;off<br /><span style="color: #66cc66;">&#40;</span><span style="color: #cc66cc;">1</span> row<span style="color: #66cc66;">&#41;</span><br />&#160;</div></code></pre>
<p>If this parameter returns <i>off</i>, you are not vulnerable. If it returns <i>on</i>, you are.</p>
<p>If you do not <b>need</b> SSL, the easiest fix is to turn this off and restart PostgreSQL. This also brings additional benefits of not paying the overhead of encryption if you don't need it. If you actually use SSL, this is of course not an option.</p>
<h3 id="toc1">It depends on your installation</h3>
<p>If you have installed PostgreSQL using a package based system, such as yum (from redhat/fedora or from yum.postgresql.org), apt (from debian/ubuntu/etc or from apt.postgresql.org), FreeBSD ports etc, it is up to your operating system to provide a patch. Most major distributions have already done this - you just need to to install it (and restart your services!). If your distribution has not yet updated, you need to convince them to do so ASAP.</p>
<p>If you are using a PostgreSQL installation package that bundles OpenSSL, you need an updated version of this package. The most common example of this is the EnterpriseDB Graphical Installers primarily used on Windows and Mac. We expect a new version of these installers to be released within a day or a few.</p>
<p>Postgres.app is also vulnerable and needs an update, but is normally not used for servers.</p>
<p>The OpenSCG separate download packages are also vulnerable.</p>
<p>For each of these you will have to wait for an updated package to show up in the next couple of days. All package maintainers have been notified, so it's only a matter of time.</p>
<p>Per the www.postgresql.org download pages we do recommend that you always use the "package manager" system for any platform where this is supported, which means most modern Linux or BSD distributions. If you are currently using one of the above installers on these platforms, a quick fix before the packages are out would be to switch to one of the "package manager" platforms that rely on the operating system update process. This may or may not be an option of course, depending on the complexity of the installation.</p>
<p>If you are using a platform where this is not available (such as Windows), your only option is to wait.</p>
<h3 id="toc2">pg_hba does not protect you</h3>
<p>In PostgreSQL, the SSL negotiation happens <i>before</i> pg_hba.conf is matched. And the vulnerability in OpenSSL is in the negotiation phase. For this reason, even if you have restricted access to your server using pg_hba.conf IP filter rules, or your pg_hba.conf specifies only <i>hostnossl</i> records, this does <b>not</b> protect you.</p>
<p>Obviously, if you have an IP level firewall, either at the host or on the network, that will protect you. But pg_hba does not.</p>
<h3 id="toc3">Usage in pgcrypto</h3>
<p>The <i>pgcrypto</i> module in PostgreSQL uses OpenSSL to provide encryption functions when available. Since the vulnerability is specifically in the protocol negotiation, use in pgcrypto is <b>not</b> vulnerable to this issue.</p>
Tue, 08 Apr 2014 08:50:00 +0000http://blog.hagander.net/archives/219-guid.htmldebianencryptionpgcryptopostgresqlreleasesecuritysslubuntuOut with the old... PostgreSQL 8.3 reaches end-of-life.http://blog.hagander.net/archives/211-Out-with-the-old...-PostgreSQL-8.3-reaches-end-of-life..html
PostgreSQLhttp://blog.hagander.net/archives/211-Out-with-the-old...-PostgreSQL-8.3-reaches-end-of-life..html#commentshttp://blog.hagander.net/wfwcomment.php?cid=2110http://blog.hagander.net/rss.php?version=2.0&type=comments&cid=211nospam@example.com (Magnus Hagander)
<p>As of todays <a onclick="_gaq.push(['_trackPageview', '/extlink/www.postgresql.org/about/news/1446/']);" href="http://www.postgresql.org/about/news/1446/" onclick="window.open(this.href, '_blank'); return false;">release announcement</a>, PostgreSQL 8.3 is no longer a <a onclick="_gaq.push(['_trackPageview', '/extlink/www.postgresql.org/support/versioning/']);" href="http://www.postgresql.org/support/versioning/" onclick="window.open(this.href, '_blank'); return false;">supported version</a>. PostgreSQL 8.3 is end of life in according with the <a onclick="_gaq.push(['_trackPageview', '/extlink/www.postgresql.org/support/versioning/']);" href="http://www.postgresql.org/support/versioning/" onclick="window.open(this.href, '_blank'); return false;">5-year support policy</a> for all PostgreSQL major versions.</p>
<p>If you are running on any of the 8.3 versions, you should upgrade your system to 8.4 or newer <strong>immediately</strong>. If this cannot be done immediately, you should at least upgrade to 8.3.23 in the meantime. When upgrading, it's likely worth upgrading to 9.2 or at least 9.1, and not just to 8.4 which only has a bit over a year before it also goes end of life.</p>
<p>Any users of PostgreSQL 9.2, 9.1, 9.0 or 8.4 should still look at upgrading their systems to the latest minor release as of todays updates, since they contain both security and stability fixes. Minor version upgrades are, as always, just a matter of replacing your binaries and restarting the database. Automatic updates should also be out on the yum and apt repositories shortly.</p>
Thu, 07 Feb 2013 12:31:00 +0000http://blog.hagander.net/archives/211-guid.htmlpostgresqlreleasesecurityupdate